{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-22836", "assignerOrgId": "bbcbe11d-db20-4bc2-8a6e-c79f87041fd4", "state": "PUBLISHED", "assignerShortName": "Palantir", "dateReserved": "2023-01-06T21:43:46.848Z", "datePublished": "2024-01-29T18:50:37.543Z", "dateUpdated": "2024-01-29T18:50:37.543Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "bbcbe11d-db20-4bc2-8a6e-c79f87041fd4", "shortName": "Palantir", "dateUpdated": "2024-01-29T18:50:37.543Z"}, "title": "In cases where a multi-tenant stack user is operating Foundry\u2019s Linter service, and the user changes the linter name from the default value, the renamed value may be visible to the rest of the stack\u2019s tenants.", "affected": [{"vendor": "Palantir", "product": "com.palantir.skywise:guardian", "versions": [{"version": "*", "versionType": "semver", "lessThan": "2.278.0", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "In cases where a multi-tenant stack user is operating Foundry\u2019s Linter service, and the user changes a group name from the default value, the renamed value may be visible to the rest of the stack\u2019s tenants."}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to."}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "The product does not perform an authorization check when an actor attempts to access a resource or perform an action.", "lang": "en", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N/CR:H/IR:H/AR:H", "baseSeverity": "LOW", "baseScore": 3.5}, "format": "CVSS"}], "references": [{"url": "https://palantir.safebase.us/?tcuUid=f9bf67ef-be15-4f87-a526-bf6064e8f682"}], "source": {"discovery": "EXTERNAL", "defect": ["PLTRSEC-2023-11"]}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:guardiansoft:guardian:*:*:*:*:*:*:*:*", "matchCriteriaId": "491F1700-B4CF-479C-A6BE-5EFD89D37599", "versionEndExcluding": "2.278.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In cases where a multi-tenant stack user is operating Foundry\u2019s Linter service, and the user changes a group name from the default value, the renamed value may be visible to the rest of the stack\u2019s tenants."}, {"lang": "es", "value": "En los casos en que un usuario de pila multi-tenant est\u00e9 operando el servicio Foundry\u2019s Linter y el usuario cambie el nombre de un grupo del valor predeterminado, el valor renombrado puede ser visible para el resto de los inquilinos de la pila."}], "id": "CVE-2023-22836", "lastModified": "2024-02-08T01:47:19.407", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "cve-coordination@palantir.com", "type": "Secondary"}]}, "published": "2024-01-29T19:15:08.100", "references": [{"source": "cve-coordination@palantir.com", "tags": ["Third Party Advisory"], "url": "https://palantir.safebase.us/?tcuUid=f9bf67ef-be15-4f87-a526-bf6064e8f682"}], "sourceIdentifier": "cve-coordination@palantir.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-862"}], "source": "cve-coordination@palantir.com", "type": "Secondary"}]}

{}